KDE can be configured to support the PAM ("Pluggable Authentication 
Module") system for password checking by the display manager kdm and 
by the screen saver kscreensaver (for unlocking the display).

PAM is a flexible application-transparent configurable user-authentication 
system found on FreeBSD, Solaris, and Linux, where it is most commonly
found on RedHat Linux systems.  (There may be ports to other unices too).

Information about PAM may be found on its homepage
      http://www.kernel.org/pub/linux/libs/pam/
(Despite the location, this information is NOT Linux-specific.)

************************Solaris issues**********************************
*
* For compiling PAM support on Solaris,  PAM_MESSAGE_NONCONST must
* be defined.   This should now be handled automatically by the 
* autoconf script:  just use ./configure --with-pam  . 
*

**********************Red Hat Linux issues***************************
*
* IMPORTANT: compiling KDE with PAM support on RedHat 5.0 Linux
* (libc6=glibc2) systems, using the supplied gcc-2.7.2.3 compiler, 
* is  *NOT RECOMMENDED*.
*
* Instead use the egcs-1.0.2 (or higher) compiler on RedHat 5.x.  
*
* The standard RedHat 5.0 gcc-2.7.2.3 compiler produces a kdm that does 
* *NOT* work with the pam_pwdb.so modules used by xdm in RedHat 5.0.
* (symptom: X display crashes, /var/log/xdm-error.log reports
* "... Unknown session exit code 2816 ....").   
* However, this compiler works fine for compiling KDE  without PAM support.
*

*  details added ( 15 APR 1999) <duncan@kde.org>
*  The problem is only present when libc6 (glibc) is used: the crash occurs
*  when PAM attempts to write messages to the System Log using the glibc2
*  function vsyslog().  This assembles the syslog message  by writing its
*  various parts into a memory stream; this fails and a message is
*  left as a NULL string that causes a crash later.   The PAM code taken from
*  kdm works fine as standalone code though.  This means it is not a simple
*  glibc bug.    Using a patched glibc where vsyslog() assembles the
*  message without using the memory stream worked too.
*  This problem occurs only when all of (kde+kdm+PAM+gcc-2.7.2.3+glibc-2.0.7)
*  are present.   





* This problem is *NOT PRESENT* in Red Hat 4.x systems (libc5): 
* On these systems you may safely compile KDE with PAM support
* using the supplied gcc (and gcc-c++) compiler.
*
* If compiling KDE with egcs, you *MUST* use Qt compiled with egcs.

* The egcs compiler comes standard with RedHat 5.1; you
* may safely install RedHat 5.1's egcs compiler in RedHat 5.0, if
* you want to compile KDE with PAM support, but do not wish to upgrade 
* to Red Hat 5.1.   libstdc++-2.8.0 is also needed.
*
* When compiling on RedHat 5.1, make sure that egcs is used
* instead of gcc for compiling C code in KDE (the PAM code
* is mainly C).  (By default, RH5.1 uses egcs for C++ but
* gcc for C.)
*
* To make egcs compile both the C and the C++ code, either:
*
*   export CC=egcs  
*
* before compiling, or, for a more permanent change,
*
*   mv /usr/bin/gcc  /usr/bin/gcc-2.7.2.3
*   ln -s ./egcs /usr/bin/gcc
* 
*  (Make sure you symlink ggc back to /usr/bin/gcc-2.7.3.2
*  before recompiling Linux 2.0.x kernels, though; egcs
*  is not recommended for compiling these kernels).
****************************************************************

If both PAM and shadow passwords are used on your system, do *NOT*
configure KDE for shadow password support: configure it for PAM, and 
PAM will take care of everything.   

By default, use of PAM is DISABLED in KDE.  To enable it, use
./configure --with-pam
This form configures KDE to use the default PAM service "xdm",
which is likely to be present and properly configured on most
PAM-aware systems.

If the PAM service "xdm" is not present, or if you wish to customize
the PAM configuration, use
./configure --with-pam=<pam_service_name> 
where <pam_service_name> is the name of the PAM service you wish to use.  
(Exception: --with-pam=yes is equivalent to --with-pam, and --with-pam=no
is equivalent to  --without-pam,  which is the default). 
You must then (as root) configure this new PAM service, if it has
not already been configured.  PAM services are generally configured by 
lines beginning with the entry <pam_service_name> in a file /etc/pam.conf or, 
on more recent systems, in individual files /etc/pam.d/<pam_service_name>.

If your system uses /etc/pam.d for configuration you may wish to use
./configure -with-pam=kde
so KDE uses a PAM service called "kde", and make a symlink
ln -s ./xdm /etc/pam.d/kde,  (assuming xdm is PAM-configured).

You can later customize your system  by creating your
own /etc/pam.d/kde.   A sample (for RedHat Linux 5.x) is
provided as kdebase/kde.pamd

PAM writes entries to the system log identified by the PAM service
name; this method has the advantage that such entries will identify 
the PAM service involved as "kde" rather than "xdm", which is 
presumably not running.    

If there is ever any doubt about which PAM service name kdebase
was compiled with, it can be determined by examining the
PAM-generated entries in the system log associated with kdm logins
or kscreensaver authentication failures....


PAM configuration files have four types of entries for each
service:
		used by kdm		used by kscreensaver
auth		    x				x
account		    x				
password	    x				
session		    x

There may be more than one entry of each type.
Check existing PAM configuration files and PAM documentation on
your system for guidance as to what entries to make.  If you
call a PAM service that is not configured, the default action
of PAM is likely to be denial of service.

Note: kdm implements PAM "session" support, which is not implemented 
in certain PAM-aware xdm's (e.g., the Red Hat Linux xdm) that it may be 
replacing.  This may be configured to carry out actions when a user opens 
or closes an kdm session, if a suitable PAM module is available 
(e.g., mount and unmount user-specific filesystems).





